Attachment 6 OPSEC red_Redacted.pdf

This document is an Operations Security (OPSEC) Contract Requirements form for Portsmouth Naval Shipyard that must be attached with solicitation and award documents.

The document establishes OPSEC requirements to protect sensitive information from unauthorized disclosure, whether classified or unclassified. An OPSEC plan is required to record, identify, and monitor contractor OPSEC activities during contract performance. The form indicates that an OPSEC plan is NOT required for this particular contract, with a signature date of 8/24/26. The contractor is responsible for protecting Critical Information and Indicators (CII) and Controlled Unclassified Information (CUI) during contract performance and shall not distribute such information to unauthorized third parties, including foreign entities. U.S. Government CII cannot be publicized in corporate newsletters, trade magazines, displays, internet pages, or public websites, and transmission to personal email accounts or posting on social media is prohibited. Unauthorized disclosure or compromise of CII may result in contract termination and criminal prosecution.

The document provides specific examples of CII including personally identifiable information, operation schedules, equipment capabilities, facility identification, and photographs taken within shipyard work areas. Countermeasures required include prohibiting posting of sensitive information to company websites or social media, shredding all sensitive documents using approved NSA crosscut shredders, removing badges upon departure, and immediately reporting unauthorized disclosures to the unit sponsor and Activity Security Manager. The PNSY Portable Electronic Device (PED) Policy restricts contractor use of easily transportable electronic devices capable of recording or transmitting data without prior coordination with the sponsor.